CVE-2026-4131: 
WordPress vulnerability analysis and mitigation

CVE-2026-4131 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Responsive Popup + Optin plugin for WordPress, affecting all versions up to and including 1.4. The flaw allows unauthenticated attackers to modify all plugin settings — including the wpo_image_url parameter — by tricking a site administrator into clicking a malicious link. It was published on April 22, 2026, and assigned a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-352 (Cross-Site Request Forgery). The vulnerability exists in wpo_admin_page.php, where the settings form on the plugin's admin page lacks both nonce generation (wp_nonce_field) and nonce verification (wp_verify_nonce / check_admin_referer). Without these WordPress security tokens, the application cannot distinguish legitimate administrator-initiated requests from forged ones. An attacker crafts a malicious HTML form or link that, when visited by an authenticated administrator, silently submits a POST request to update plugin settings (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker to modify all WP Responsive Popup + Optin plugin settings on the targeted WordPress site, including the wpo_image_url parameter, which could be used to inject malicious content (e.g., phishing images or scripts) into popup displays shown to site visitors. This poses a risk to site integrity and could expose visitors to malicious content, though availability is not directly impacted. The scope is changed, meaning the impact extends beyond the plugin itself to the broader WordPress site and its end users (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.01% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering — specifically, tricking a logged-in WordPress administrator into clicking a crafted link — which limits opportunistic mass exploitation.

1. Reconnaissance: Identify WordPress sites running the WP Responsive Popup + Optin plugin at version 1.4 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Create an HTML page or email containing a hidden auto-submitting form that targets the plugin's settings endpoint (e.g., the admin form handler in wpo_admin_page.php), with attacker-controlled values for plugin settings such as wpo_image_url pointing to a malicious resource.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other communication channel, enticing them to click it while authenticated to their WordPress dashboard.
4. Trigger forged request: When the administrator visits the attacker's page, the browser automatically submits the forged POST request with the administrator's session cookies, bypassing CSRF protections due to the missing nonce.
5. Achieve objective: Plugin settings are updated with attacker-controlled values; for example, the popup image URL is replaced with a malicious image or redirect, exposing site visitors to phishing content or malware (GitHub Advisory, Wordfence).

• Logs: WordPress admin action logs showing unexpected changes to WP Responsive Popup + Optin plugin settings (e.g., wpo_image_url modified to an external or suspicious URL) without a corresponding administrator login session from a known IP.
• File System: No direct file system changes expected, but review plugin option values stored in the WordPress wp_options table for unexpected wpo_image_url or other plugin setting values pointing to external domains.
• Network: Outbound requests from the WordPress site or visitor browsers to unfamiliar or suspicious image/resource URLs injected via the wpo_image_url parameter in popup displays.
• Database: Unexpected updates to plugin-related rows in the wp_options table (e.g., option names prefixed with wpo_) at unusual times or from unexpected admin sessions.

Update the WP Responsive Popup + Optin plugin to a version above 1.4 that includes proper nonce implementation (wp_nonce_field for form generation and wp_verify_nonce/check_admin_referer for verification). Until a patched version is available, site administrators should deactivate or remove the plugin to eliminate the attack surface. Additionally, train administrators to avoid clicking unsolicited links, and consider implementing a Web Application Firewall (WAF) rule to block unauthorized POST requests to plugin admin endpoints (GitHub Advisory, Wordfence).

Wordfence identified and reported this vulnerability, including it in their weekly WordPress vulnerability report for April 20–26, 2026 (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been observed.